Let's encrypt own domain at hover.com dns (not DuckDNS) on raspberry pi

[thebitpit (Mac Michaels)]

I am trying to get a server certificate for ESPHome and home-assistant on HassOS on a raspberry pi 3B+. I want to enable https. I own my domain AustinCustomErrands.com and use it to serve my wife’s website written by hand in HTML5 with no wordpress, analytics or website builder stuff. I configured my domain dns records to work with firebase and zoho email.

I am trying to get a certificate for a subdomain of AustinCustomErrands.com. Long ago I created a domain [orchestra] on the LAN and assigned various computers the names of musical instruments with reserved ipv4 addresses on my Netgear router.

I read the Let’s Encrypt and tried the http method. I never worked for me. I am not sure what records need to be added to my domain’s dns. I stopped working on it when I noticed strangers attempting to access the enter http port on my router.

hover.com is not supported in home-assistant. It is rejected. I tried a couple other dns providers, but they did not work. I do not need access outside my local home network now, but in the future I may want it.

I tried to create a subdomain using 2 CNAME records orchestra.austincustomerrands.com.
orchestra CNAME austincustomerrands.com
*.orchestra CNAME austincustomerrands.com

How can I get a certificate for hover.com using dns method?

It doesn’t need to actually route yet. That will come later when I get an routable IPV6 address for my raspberry pi and connect it to the internet.

[aceindy]

useful??

Lets encrypt certbot, not duckdns, auto renew

I do approx the same, but I use the certbot windows version. It is a scheduled batch file, which runs daily. It consists of: running certbot copying the pem files to the HA samba share

How to fix SSL certifications after Domain change

Hmm, i use my own domain, and I use certbot to generate my certificates (which is let’s encrypt and also used by duckdns). Registering is a bit of a hassle, as you need to prove that you host the domain (and need to host a webserver on port 80 as part of the registration process). I run certbot on my windows machine as scheduled task to check/update the certificate on my webserver daily and then move it to HA’s samba share

[thebitpit (Mac Michaels)]

Can’t find any help in certbot about running HassOS. Do I have to run certbot on a different computer with a normal Linux OS?

I have only been working with homeassistant for a couple of weeks (I gave up on OpenHAB). I assumed the Let’s Encrypt add-on would take care of automatic certificate renewal. I expected the generic dns challange example to have yaml that caused Let’s Encrypt to generate data to put in TXT record on my domain to prove I own it.

Maybe I am asking the wrong questions. All I want to do is make ESPHome work in homeassistant. I see references to a requirement that I get server certificates so that https will work. Firebase set that all up for me to host the website at austincustomerrands.com (both http and https). I just add records it suggests to my domain DNS at hover.com.

[aceindy]

@thebitpit

All I want to do is make ESPHome work in homeassistant

What is the relation between ESPHome and SSL ??

[thebitpit (Mac Michaels)]

In the supervisor node it has “open web ui”. Firefox Browser console has messages like this:

HTTPS-Only Mode: Not upgrading insecure request “http://homeassistant.orchestra:8123/auth/authorize?response_type=code&redirect_uri=http%3A%2F%2Fhomeassistant.orchestra%3A8123%2F%3Fauth_callback%3D1&client_id=http%3A%2F%2Fhomeassistant.orchestra%3A8123%2F&state=eyJoYXNzVXJsIjoiaHR0cDovL2hvbWVhc3Npc3RhbnQub3JjaGVzdHJhOjgxMjMiLCJjbGllbnRJZCI6Imh0dHA6Ly9ob21lYXNzaXN0YW50Lm9yY2hlc3RyYTo4MTIzLyJ9” because it is exempt.

HTTPS-Only Mode: Not upgrading insecure request “http://homeassistant.orchestra:8123/?auth_callback=1&code=ebefc44f94a24dbf97c47814203586fb&state=eyJoYXNzVXJsIjoiaHR0cDovL2hvbWVhc3Npc3RhbnQub3JjaGVzdHJhOjgxMjMiLCJjbGllbnRJZCI6Imh0dHA6Ly9ob21lYXNzaXN0YW50Lm9yY2hlc3RyYTo4MTIzLyJ9” because it is exempt.

HTTPS-Only Mode: Not upgrading insecure request “ws://homeassistant.orchestra:8123/api/websocket” because it is exempt.

[aceindy]

@thebitpit

HTTPS-Only Mode: Not upgrading insecure request “ws://homeassistant.orchestra:8123/api/websocket” because it is exempt.

I am quite sure you don’t need ssl for esphome, especially cause supervisor uses ingress

But at first glance this appears to be a firefox bug
Have you tried googling “HTTPS-Only Mode: Not upgrading insecure request because it is exempt.” ?
I suggest you try another browser?

[thebitpit (Mac Michaels)]

I found a sloppy work around. Go to firefox Settings->Privacy & Security->HTTPS-Only Mode->[Manage Exceptions…] button (near the bottom of the page). In the menu add website homeassistant:8123 then click button [Turn Off], not [Turn Off Temporarily]. It does not address my issue, but I can access homeassistant.

The real issue is still how to make Let’s Encrypt add-on work with hover.com. I did finally figure out how to make the Let’s Encrypt add-on work using dns-google on my domain (make google create a google.json file), It validated and did everything except issue a certificate. A monthly fee to google is required to get them to actually issue server certificates. I think google also sets up CDN (which I do not need at all). They do it for free with my wife’s free firebase hosted website, but not for my own subdomain.

I was hoping that setting up SSL with my domain would unlock some “additional features” (mentioned in documentation without any details) in homeassistant.

I am giving up on this for now - this rabbit hole is full of unexpected twists and turns. Thank you for your help.